Remote updates move activeVersion on but leave the unit starting the launcher
from the runtime that installed it, so state-based cleanup could delete that
runtime and the next restart failed with 203/EXEC. Installs now record
launcherVersion, pruning keeps it, and the launcher carries it through update
transitions, taking the on-disk value so a `t3 update` that repointed the unit
without a restart is not overwritten.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>